Commit 1ccf17e9dc for qemu.org

commit 1ccf17e9dc6bba38a9bddd3d66fdab458a50c906
Author: Tommaso Califano <tcalifano@redhat.com>
Date:   Thu Oct 8 14:29:36 2026 +0200

    hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT

    In usb_mtp_get_data() there is a guest-triggerable assertion that fires
    when a guest declares a large object size in CMD_SEND_OBJECT_INFO but
    sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion
    compares the declared size against the actual bytes received.

    If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
    CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
    final USB packet) the assertion fires, killing QEMU.

    To prevent that is sufficient to remove the assertion, because the case
    is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.

    Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993
    Signed-off-by: Tommaso Califano <tcalifano@redhat.com>
    Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261008122936.45081-1-tcalifano@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index cbc2be3317..9048cddaab 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
         d->offset += dlen;
         d->data_offset += dlen;
         if ((p->iov.size % 64) || !p->iov.size) {
-            assert((s->dataset.size == 0xFFFFFFFF) ||
-                   (s->dataset.size == d->offset));
-
             if (d->length == MTP_WRITE_BUF_SZ) {
                 d->write_status = WRITE_END;
             } else {